Reports › sign-26 · Constant-time review
SQIsign2D-push1/2 (sign-26)
| Candidate | SQIsign2D-push1/2 |
|---|---|
| Family | Isogeny-based signature |
| Archive | SQIsign2D-push12.zip (SHA-256: 98b7e4ffddfe31b5fb0f448345b49228c8d8a7c87078688ba1656b28631448c5) |
sign-26-1: Prime sizing assumes a superseded square-root isogeny cost
| Severity | Medium |
|---|---|
| Scope | design |
| Status | Lead |
| Affected | All four submitted levels' prime-sizing rationale |
| Discovery | Moderate |
| Exploitation | Asymptotic attack applies to the underlying problem; concrete signature/key-recovery cost unresolved |
| Credit | Yintong Luo (GitHub @yintong16) |
| Date | 2026-09-23 |
Original source: GitHub issue #10
Section 5.1 chooses the prime size from the then-best classical p^1/2 endomorphism-ring/isogeny attack; §6.4.1 uses the same estimate for key recovery. Wesolowski, ePrint 2026/1486 gives a heuristic p^(1/3+o(1)) time-and-memory algorithm for the underlying supersingular isogeny problem. Thus the submitted log2 p ≈ 2λ sizing premise is superseded at all four levels, not only Level-3 and Level-4. For example, Level-1 has log2 p ≈ 254.6, so the bare p^1/3 exponent is about 84.9 against its 128-bit claim. This is not a concrete attack cost: the paper warns that superpolynomial overhead and high memory may close smaller margins. The consequence for every actual parameter set remains unresolved; this is a parameter-selection lead, not a demonstrated full-size key recovery or forgery.
Reproducing
Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).
Compare §5.1 and §6.4.1 of sign-26-spec.pdf, especially their p^1/2 premise, with the cited paper and all four prime sizes in the specification.